From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-240.mail.qq.com (out203-205-221-240.mail.qq.com [203.205.221.240]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5AE5F40DFBD for ; Sat, 18 Apr 2026 04:35:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.240 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776486941; cv=none; b=A7g98YhCD/nmTKXNheG2Tx9tWS6563Wja0QITZyvk8wCCZM7HLZ1D5CnwoKEU8vsko62vBHvxyIY/fvvnxDErz6hfV7iiZCyMcFEmvNe1JeCr3Ok0I1KK+LF3ByV3sjBjXmb62CNBgd8R2GQ1h9FbfB54dvljw9hnykhfcz3Ieo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776486941; c=relaxed/simple; bh=RDqsUkIYmvcHXaod22pBp/n3C+5dznYc6vgrpFZlumY=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=Mbe58nBb0JuRKvpFcipmDakNa50aU2Og6KqvQhVhZ055jQDyvORBLOW97uNc7nQcxofU9rSWKl9e3jY++MK0a6x1xvdm9G+nCXqTPRaLpa63ATz6Jt5RB207G1YLs9OYMpTuC16TRrlxpmWkQWSclvrjbvehAPQgEsrS5Hagh74= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=GtdeiXXw; arc=none smtp.client-ip=203.205.221.240 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="GtdeiXXw" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1776486929; bh=C2NAlm42uNYkkvkDqzc7RuI0IxvfMvzNdkr8IrH+VcM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GtdeiXXwdp1JDBXtHc5ag7pb8PCK15k03BNu1+HE5MJ5memYi+katgVhN8NnSBdT5 1Xj29qoc5q7U5tymdxr9UO4P98YQ26UiBhwN5hi24zi9Op+tDM3VTIx0EjFDpAVYvF X5Ec3SbOuh30djMjfMM7LMWVeKHhrKdHSwwQzcqg= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrszc50-0.qq.com (NewEsmtp) with SMTP id 8DBB4C1B; Sat, 18 Apr 2026 12:35:27 +0800 X-QQ-mid: xmsmtpt1776486927t6lf7pacg Message-ID: X-QQ-XMAILINFO: MZtEYADUG4AgUxCqNVx+p6oagUGrv45tNyQFxOXnJLBCt+UDwYGRQvUbxUDhaE WJHA+KsEHQRl7JxvDWLELslP6D1S0qPU/DRWxO6OHDYu+GO7b3pqHFV0sjlbGKir+4OMuT7K0vXn YNzbI6tj/O7m/ZU66NgRMchsCeggGVZiuWw/hnFCunLJDOA13C86ipdQu+FCITNPfVgyfQbMIJzW bDbFeEqrCCqao0GcTxrTkuWpHAy2n+zeMLKBdzrOTId1ZDMD1Y5l0Cv/QZtAXd+IxsFB3mLQhulo c2ZUVOiwOzc66mfh5AODcR3dPyygRRBfAhT54zgyls5dgNb1fQ+YZHSDJ8j5atdj8PcLsmnq5TCP GK1GypRwjEg6wpU/P0NhjYPQQ3pQz49dmyVRdIIm+V9psOtQ1PfUVyL3Dr8vYbYQRozorwEKmIXr jujUb9DafZIx5arwvGneB3gOI8UdFHAJ6QTNnesGFlSmLQnxQHohdCE4UT9FQtPWllQXr3O4huXw ZnYTKf3lVUUHDa41nD3YlemAkYJfUnNiTeSGW9NWGl7H4wJ6MiThapya1FcHPQbaZlCieF/fH4f4 osFP1u7v+/iiIJR+GMMPN20N8f1qf6bfsrGYecx991Xt99UX46GUCXPqt3yjxWD824iIt5ygURJf lGj7nQGOtqKQuunk9lBo7GmeijqdYkI2+VHbPCf0TJLTDvX7QpupCXF2XNzZLpkVCWYRO7GV8dWn BbeuRH5Q08dxNTapbBI1XY33n9/ootjnnEhylSko4E6FZPsJ1mLPYTmT+7bDZE4IrX2d4neUbUtp ttmCx6Ggts9FEjY0IeSGeMHRT42yMiKM2PWJ/fNANMzkazgvcdWyBatYToeyzXunUb5fLNqltJE6 kFGVOZvoewo3B4c+XOl7sVPHKPvb0QshLSgPOrTqjsG8DtxHf9MTqR4vlycUP7fuMqurIjm9iu1U Gh7YCov0R/+d4/EdwQznJDDpau/g7R5RcBnV41dSgrBFhNTvJ/a3UkgJ7GIC/hZaC66CobhCk= X-QQ-XMRINFO: M/715EihBoGS47X28/vv4NpnfpeBLnr4Qg== From: Edward Adam Davis To: syzbot+ecf51a7ccb6b1394e90c@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [jfs?] KASAN: slab-use-after-free Read in lbmIODone Date: Sat, 18 Apr 2026 12:35:28 +0800 X-OQ-MSGID: <20260418043527.450247-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69df5517.a00a0220.468cb.0074.GAE@google.com> References: <69df5517.a00a0220.468cb.0074.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test: upstream master diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c index 5f31c12f4607..f795f19d24bb 100644 --- a/fs/jfs/jfs_logmgr.c +++ b/fs/jfs/jfs_logmgr.c @@ -1984,7 +1984,7 @@ static int lbmRead(struct jfs_log * log, int pn, struct lbuf ** bpp) submit_bio(bio); } - wait_event(bp->l_ioevent, (bp->l_flag == lbmDONE)); + wait_event(bp->l_ioevent, (bp->l_flag & lbmDONE)); return 0; } @@ -2192,11 +2192,6 @@ static void lbmIODone(struct bio *bio) if (bp->l_flag & lbmREAD) { bp->l_flag &= ~lbmREAD; - LCACHE_UNLOCK(flags); - /* wakeup I/O initiator */ - LCACHE_WAKEUP(&bp->l_ioevent); - LCACHE_LOCK(flags); /* disable+lock */ - goto out; } @@ -2219,10 +2214,8 @@ static void lbmIODone(struct bio *bio) log = bp->l_log; log->clsn = (bp->l_pn << L2LOGPSIZE) + bp->l_ceor; - if (bp->l_flag & lbmDIRECT) { - LCACHE_WAKEUP(&bp->l_ioevent); + if (bp->l_flag & lbmDIRECT) goto out; - } tail = log->wqueue; @@ -2273,10 +2266,7 @@ static void lbmIODone(struct bio *bio) * leave buffer for i/o initiator to dispose */ if (bp->l_flag & lbmSYNC) { - LCACHE_UNLOCK(flags); - /* wakeup I/O initiator */ - LCACHE_WAKEUP(&bp->l_ioevent); - LCACHE_LOCK(flags); /* disable+lock */ + goto out; } /* @@ -2302,6 +2292,8 @@ static void lbmIODone(struct bio *bio) out: bp->l_flag |= lbmDONE; + /* wakeup I/O initiator */ + LCACHE_WAKEUP(&bp->l_ioevent); LCACHE_UNLOCK(flags); }